CISA CPE Requirements 2026: 20 Hours a Year, 120 Over 3 Years

ISACA says that maintaining the Certified Information Systems Auditor (CISA) credential requires a minimum of 20 CPE hours reported each year and at least 120 hours over a three-year reporting period. The rules also come with an annual maintenance fee, a random audit and a new CPE policy that ISACA has announced for 1 January 2027. This guide sets out what ISACA publishes today, what is changing, and where its own pages disagree. If you work in audit more widely, our internal audit CPD training guide and CIA CPE requirements guide cover the other main credential.

At a glance

20 a year and 120 over three

ISACA's CISA maintenance page says you must report at least 20 CPE hours annually and earn and report at least 120 hours related to CISA over a three-year period. The same 20-and-120 pattern appears on ISACA's pages for CISM, CRISC and CGEIT. Because hours can count towards more than one ISACA certification, someone holding two credentials can often use the same training for both, within each policy's rules.

Fees

ISACA says the annual maintenance fee is US$45 for ISACA members and US$85 for non-members. The same page lists lower amounts for a third and later certification, and says invoices start in September. The page carries no date, so check the current amount on your invoice.

What counts

ISACA's how-to-earn page says technical and managerial training counts and basic office-software training does not. Some activities are capped each year: 10 hours for vendor sales presentations, 20 for serving on ISACA boards or committees, 20 for contributions to the profession and 10 for mentoring. Self-study, teaching, publication and exam development have no cap, and teaching earns five times the presentation time for the first delivery. Hours can be reported in quarter-hour increments.

How hours are measured

ISACA's CISM and CRISC policy documents, which we could read, count one CPE hour per 50 minutes of active participation. We could not read the CISA policy PDF, so we cannot confirm the CISA wording is identical, though the pages describe the same approach.

Ethics

CISA holders agree to comply with ISACA's Code of Professional Ethics. We did not find a requirement for a set number of ethics CPE hours on the pages we could read.

Audits and proof

ISACA selects holders for audit at random, regardless of how many hours or which categories they reported, and being audited before does not exclude you. The audit of hours reported for 2025 was notified in June 2026 with a deadline of 7 August 2026. Selected holders send PDF copies of their proof. Valid proof includes a certificate of completion or attendance, a confirmation letter or a signed Verification of Attendance form. An email confirmation without the duration or hours is not accepted, and hours without support are removed. ISACA asks holders to keep documentation for 12 months after the end of each three-year cycle.

If you do not comply

Holders who do not comply with the audit have their CISA certification revoked. A revoked holder can appeal with CPE documentation, and if the appeal is approved the holder pays outstanding fees plus a US$50 reinstatement fee. If the appeal is denied, you must retake and pass the exam. ISACA also offers retired status, which is permanent and can only be undone by retaking the exam, and a non-practicing status that has no CPE requirement but still carries the annual fee.

The January 2027 policy change

ISACA has announced a new CPE policy that takes effect on 1 January 2027. The 120 hours over three years do not change. At least 90 must align to the exam content outline or domains of the certification, and at most 30 can be general professional development. Vendor sales or marketing demos will no longer qualify, and the volunteering caps change to 20 a year on boards aligned to the exam and 20 a year on other boards, with cycle limits. ISACA says no system changes will happen in the 2026 cycle and that the audit process stays the same.

What we could not confirm

The CISA-specific policy PDF was unavailable, so we could not confirm the reporting-year start or the exact deadline for CISA. The CISA, CISM, CRISC and CGEIT web pages say payment is due annually by 1 January, while the CISM and CRISC policy documents say payment and reporting are due by 31 December. We also saw conflicting signals on whether the 20-hour annual minimum survives the 2027 policy, since an ISACA chapter announcement says it stays and the policy summary page shows no annual minimum. Please check the live ISACA pages before you plan around the deadline or the 2027 split.

Frequently asked questions

How many CPE hours does a CISA need?

At least 20 hours reported each year and at least 120 over each three-year reporting period.

How much does CISA maintenance cost?

ISACA's CISA page lists US$45 a year for members and US$85 for non-members. The page is undated, so confirm on your invoice.

Can one course count for two ISACA certifications?

Yes. ISACA says hours can count towards more than one certification.

What happens if I am audited and cannot show proof?

Unsupported hours are removed, and holders who do not comply with the audit have their CISA revoked.

What changes in 2027?

A new ISACA CPE policy takes effect on 1 January 2027, with at least 90 of the 120 hours aligned to the exam content outline and at most 30 as general professional development.

Finding courses that count

Learnsignal publishes accounting, tax, audit, ethics and finance courses in its CPD and CPE library. Before you pay for any course, check the awarding body's own rules on what it accepts, and keep the certificate and the course details. For wider reading, see CPD for accountants and CPE versus CPD.

Source: ISACA CISA maintenance page, how-to-earn-CPE page, annual CPE audit page, certification status page, CPE 2027 page and the CISM and CRISC CPE policies of January 2025 (isaca.org), checked October 2026.